Data Protection
This page describes what data Just Loot collects, how it is used, and how it is protected. It supplements our Privacy Policy and is intended for app store data-safety disclosures and GDPR transparency.
Data controller
Just Loot is operated by the developer listed on the App Store and Google Play. For data protection requests, contact timhilgenstoehler+justloot@gmail.com.
Summary
- We collect account and game data to run cloud saves, arena, and leaderboards.
- We do not sell personal data.
- Data is encrypted in transit (HTTPS/TLS).
- You can request deletion of your account and associated data by email.
Data we collect
| Data type | Examples | Required? | Purpose |
|---|---|---|---|
| Account identifiers | Email address, user ID, guest session ID | Yes (to save progress) | Authentication, account recovery, cloud sync |
| Profile information | Display name, avatar selection | Optional | Social feed, leaderboards, arena identity |
| Game progress | Character stats, inventory, equipment, depth, currency | Yes (core gameplay) | Cloud save, gameplay features, balance analytics |
| Multiplayer & competitive data | Arena rating, match history, leaderboard entries | Yes (for those features) | Ranked arena, public leaderboards |
| Usage analytics | Session counts, run outcomes, feature usage aggregates | Yes (improve the game) | Game balance, bug fixes, product decisions |
| Crash & diagnostics | Crash reports, error stack traces, app version | Automatic when crashes occur | Stability and bug fixing |
| Purchase metadata | Subscription status, entitlement state | Only if you buy Plus | Unlock premium features; managed via store billing |
| Device information | OS version, device model (support/crash context) | Only when needed | Support, diagnostics |
We do not collect precise location, contacts, photos, microphone audio, or health data.
Data we do not collect
- Advertising identifiers for third-party ad tracking
- Payment card numbers (handled by Apple App Store / Google Play)
- Biometric data
- Sensitive personal categories beyond what you voluntarily provide in your profile
How data is used
- Provide and sync gameplay across sessions and devices
- Operate arena matchmaking, leaderboards, and social features
- Maintain subscription access for Just Loot Plus
- Monitor crashes and improve performance
- Respond to support and legal requests
Legal bases (EEA / UK)
- Contract: Processing needed to provide the game and cloud save services you use.
- Legitimate interests: Analytics, security, fraud prevention, and product improvement, balanced against your rights.
- Consent: Where required (e.g. optional tracking prompts on iOS), you may withdraw consent in device settings.
- Legal obligation: Retention or disclosure when required by law.
Third-party processors
| Service | Role | Data shared |
|---|---|---|
| Supabase | Authentication, database, file storage | Account, game save, analytics events |
| Sentry | Crash and error reporting | Crash diagnostics, device/app context |
| RevenueCat | In-app purchase & subscription management | User ID, purchase/entitlement status |
| Apple / Google | App distribution and billing | Store account and transaction data (handled by the store) |
These providers process data on our behalf under their own terms and privacy policies. We do not authorize them to use your data for their own marketing.
Sharing & sale
We do not sell your personal information. We share data only with service providers listed above, when you choose public leaderboard/social features, or when required by law.
Security
- All network traffic uses HTTPS/TLS encryption
- Access to production systems is restricted to the developer
- Authentication tokens are stored using platform secure storage where available
Retention
We keep account and game data while your account is active. After a deletion request, we remove personal data within 30 days unless a longer period is required for legal, security, or dispute-resolution reasons. Aggregated analytics without personal identifiers may be retained longer.
Your rights
Depending on your location, you may have the right to access, correct, delete, restrict, or export your data, and to object to certain processing. To exercise these rights, email timhilgenstoehler+justloot@gmail.com from the address linked to your account.
Children
Just Loot is not directed at children under 13 (or the applicable age in your country). We do not knowingly collect personal data from children.
International transfers
Our service providers may process data in the United States or other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses offered by our providers.
Changes
We may update this page when our data practices change. The “Last updated” date at the top will reflect the latest version.